# GTG-50014

> As of 2026-10-26, GTG-50014 is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware, apt. ATT&CK coverage spans 36 techniques across 14 tactics in 2 of 2 tracked threats. Most-observed techniques: T1199 (Trusted Relationship), T1552.001 (Unsecured Credentials), T1567.002 (Exfiltration to Cloud Storage).

- **Tracked threats:** 2
- **Categories:** RANSOMWARE, APT
- **As of:** 2026-10-26

## ATT&CK techniques observed

36 techniques observed across 2 of 2 tracked threats. Tactics: Credential Access (7), Initial Access (6), Resource Development (4), Persistence (3), Reconnaissance (3), Collection (2).

- [T1199](https://intel.threadlinqs.com/technique/T1199) Trusted Relationship — Initial Access — observed in 2 of 2 tracked threats
- [T1552.001](https://intel.threadlinqs.com/technique/T1552.001) Unsecured Credentials — Credential Access — observed in 2 of 2 tracked threats
- [T1567.002](https://intel.threadlinqs.com/technique/T1567.002) Exfiltration to Cloud Storage — Exfiltration — observed in 2 of 2 tracked threats
- [T1018](https://intel.threadlinqs.com/technique/T1018) Remote System Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1021.006](https://intel.threadlinqs.com/technique/T1021.006) Windows Remote Management — Lateral Movement — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1053.005](https://intel.threadlinqs.com/technique/T1053.005) Scheduled Task/Job: Scheduled Task — Persistence — observed in 1 of 2 tracked threats
- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 1 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1078.004](https://intel.threadlinqs.com/technique/T1078.004) Cloud Accounts — Persistence — observed in 1 of 2 tracked threats
- [T1090](https://intel.threadlinqs.com/technique/T1090) Proxy — Command and Control — observed in 1 of 2 tracked threats
- [T1114](https://intel.threadlinqs.com/technique/T1114) Email Collection — Collection — observed in 1 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 1 of 2 tracked threats
- [T1195.002](https://intel.threadlinqs.com/technique/T1195.002) Supply Chain Compromise — Initial Access — observed in 1 of 2 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 1 of 2 tracked threats

## Tracked threats

- [AI-Enabled Ransomware and Extortion Economics: Stolen AI Credentials, Aurora Ransomware and GTG-50014 Affiliate Operations](https://intel.threadlinqs.com/threat/TL-2026-4475) — HIGH
- [Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated Cyberattacks and Data Theft](https://intel.threadlinqs.com/threat/TL-2026-2466) — CRITICAL

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/GTG-50014